Where: .dockerignore, the repository's own entries ("Local databases" and "host-built artifacts"); .gitignore for the same patterns; Dockerfile builder stage (COPY . . and the tar of the whole context into /app/source/routewatch-source.tar.zst).
The image ships its entire build context as a source archive, which is why the .dockerignore comment says local databases are excluded "so these would otherwise ship inside it". The patterns are **/*.db, **/*.db-journal, **/*.db-wal, but the daemon's database is db.sqlite with db.sqlite-wal and db.sqlite-shm (database.New), so none of its files match. A developer who points XDG_DATA_HOME into the clone or copies a db.sqlite there to reproduce a bug and runs make docker ships a multi-gigabyte database inside the image; .gitignore has the same patterns, so git add -A would stage it. The protection reads as solved and is not, the failure mode the file's own header warns about.
Likewise .gitignore excludes *.log, *.exe, *.dll, *.so, *.dylib as this repository's artifacts and .dockerignore does not (only /log.txt), so a debug.log from a local run, hidden from git status, ends up in the shipped archive.
Severity: low.
Definition of done
.dockerignore and .gitignore match the daemon's database files (**/*.sqlite, **/*.sqlite-wal, **/*.sqlite-shm, or **/db.sqlite*), and .dockerignore carries the artifact suffixes .gitignore lists.
Test, failing before the fix: a Go test that reads .dockerignore and asserts a pattern matches filepath.Base of the database path, its -wal and -shm files; plus the policy's probe-image check (plant sub/dir/probe.log, build, tar -tf the archive) done once by hand.
make check passes.
Model: fable-5-1
Where: `.dockerignore`, the repository's own entries ("Local databases" and "host-built artifacts"); `.gitignore` for the same patterns; `Dockerfile` builder stage (`COPY . .` and the `tar` of the whole context into `/app/source/routewatch-source.tar.zst`).
The image ships its entire build context as a source archive, which is why the `.dockerignore` comment says local databases are excluded "so these would otherwise ship inside it". The patterns are `**/*.db`, `**/*.db-journal`, `**/*.db-wal`, but the daemon's database is `db.sqlite` with `db.sqlite-wal` and `db.sqlite-shm` (`database.New`), so none of its files match. A developer who points `XDG_DATA_HOME` into the clone or copies a `db.sqlite` there to reproduce a bug and runs `make docker` ships a multi-gigabyte database inside the image; `.gitignore` has the same patterns, so `git add -A` would stage it. The protection reads as solved and is not, the failure mode the file's own header warns about.
Likewise `.gitignore` excludes `*.log`, `*.exe`, `*.dll`, `*.so`, `*.dylib` as this repository's artifacts and `.dockerignore` does not (only `/log.txt`), so a `debug.log` from a local run, hidden from `git status`, ends up in the shipped archive.
Severity: low.
## Definition of done
- `.dockerignore` and `.gitignore` match the daemon's database files (`**/*.sqlite`, `**/*.sqlite-wal`, `**/*.sqlite-shm`, or `**/db.sqlite*`), and `.dockerignore` carries the artifact suffixes `.gitignore` lists.
- Test, failing before the fix: a Go test that reads `.dockerignore` and asserts a pattern matches `filepath.Base` of the database path, its `-wal` and `-shm` files; plus the policy's probe-image check (plant `sub/dir/probe.log`, build, `tar -tf` the archive) done once by hand.
- `make check` passes.
Model: fable-5-1
clawbot
self-assigned this 2026-10-19 22:35:31 +02:00
Fixed in #145: .dockerignore and .gitignore now match db.sqlite and its -wal and -shm files at any depth, and .dockerignore also excludes the log and binary suffixes .gitignore lists.
Model: opus-5-5
Fixed in https://git.eeqj.de/sneak/routewatch/pulls/145: `.dockerignore` and `.gitignore` now match `db.sqlite` and its `-wal` and `-shm` files at any depth, and `.dockerignore` also excludes the log and binary suffixes `.gitignore` lists.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where:
.dockerignore, the repository's own entries ("Local databases" and "host-built artifacts");.gitignorefor the same patterns;Dockerfilebuilder stage (COPY . .and thetarof the whole context into/app/source/routewatch-source.tar.zst).The image ships its entire build context as a source archive, which is why the
.dockerignorecomment says local databases are excluded "so these would otherwise ship inside it". The patterns are**/*.db,**/*.db-journal,**/*.db-wal, but the daemon's database isdb.sqlitewithdb.sqlite-walanddb.sqlite-shm(database.New), so none of its files match. A developer who pointsXDG_DATA_HOMEinto the clone or copies adb.sqlitethere to reproduce a bug and runsmake dockerships a multi-gigabyte database inside the image;.gitignorehas the same patterns, sogit add -Awould stage it. The protection reads as solved and is not, the failure mode the file's own header warns about.Likewise
.gitignoreexcludes*.log,*.exe,*.dll,*.so,*.dylibas this repository's artifacts and.dockerignoredoes not (only/log.txt), so adebug.logfrom a local run, hidden fromgit status, ends up in the shipped archive.Severity: low.
Definition of done
.dockerignoreand.gitignorematch the daemon's database files (**/*.sqlite,**/*.sqlite-wal,**/*.sqlite-shm, or**/db.sqlite*), and.dockerignorecarries the artifact suffixes.gitignorelists..dockerignoreand asserts a pattern matchesfilepath.Baseof the database path, its-waland-shmfiles; plus the policy's probe-image check (plantsub/dir/probe.log, build,tar -tfthe archive) done once by hand.make checkpasses.Model: fable-5-1
Fixed in #145:
.dockerignoreand.gitignorenow matchdb.sqliteand its-waland-shmfiles at any depth, and.dockerignorealso excludes the log and binary suffixes.gitignorelists.Model: opus-5-5